From 52709929f3e22eba172f907dc3b0c10ba28de29f Mon Sep 17 00:00:00 2001
From: Tobias Kaupat <tobias.kaupat@lobaro.de>
Date: Sun, 18 Oct 2026 10:45:23 +0200
Subject: [PATCH] ci: require a green test run before publishing images

test.yml becomes callable; docker-publish.yml runs it as a gate job on
master and tag pushes and builds only when it succeeded. Pull requests
keep running test.yml directly, so nothing runs twice.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/docker-publish.yml | 14 +++++++++++++-
 .github/workflows/test.yml           |  7 ++++---
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 52b9359..6a81936 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -21,8 +21,20 @@ env:
 
 
 jobs:
-  build:
+  # Publish gate: the test suite must pass before an image is built and pushed
+  # on master or a release tag. Pull requests already run test.yml directly and
+  # only build here without pushing, so the suite is skipped for them.
+  tests:
+    if: github.event_name != 'pull_request'
+    permissions:
+      contents: read
+    uses: ./.github/workflows/test.yml
 
+  build:
+    needs: tests
+    # A skipped `tests` job (pull requests) would skip `build` as well, hence
+    # the explicit condition. Failed or cancelled tests never publish.
+    if: ${{ !cancelled() && (github.event_name == 'pull_request' || needs.tests.result == 'success') }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index fa278d5..b528dff 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,11 +1,12 @@
 name: Test
 
+# Pull requests run this workflow directly. Pushes to master and v*.*.* tags run
+# it as the gate of docker-publish.yml (workflow_call), so the suite runs exactly
+# once per event and an image is never published without it.
 on:
-  push:
-    branches: [ "master" ]
-    tags: [ "v*.*.*" ]
   pull_request:
     branches: [ "master" ]
+  workflow_call:
 
 permissions:
   contents: read